1. Field of the Invention
The present invention relates to the protection of computer systems. More particularly, the present invention relates to a method and apparatus for blocking propagation of malicious code.
2. Description of Related Art
Malicious code that propagates from one computer to another over a network, e.g., via an e-mail message, is often referred to as a “worm”. Most worms that spread from one computer to another are spread via e-mail messages over the Internet, and often as attachments to an e-mail message.
The most common way to send an e-mail message over the Internet is using the SMTP (Simple Mail Transfer Protocol). Some worms that utilize the SMTP are termed metamorphic, or polymorphic, worms as the worm changes its appearance every time it replicates. By changing its appearance, the metamorphic worm often avoids detection by anti-virus programs.